Vulnerability Database

296,747

Total vulnerabilities in the database

CVE-2025-59015

A deterministic three‑character prefix in the Password Generation component of TYPO3 CMS versions 12.0.0–12.4.36 and 13.0.0–13.4.17 reduces entropy, allowing attackers to carry out brute‑force attacks more quickly.

Published: Sep 9, 2025
Updated: Sep 10, 2025
CVE: CVE-2025-59015
GHSA: GHSA-p5jq-5383-qvc7
Severity: Medium
Exploit:

CVSS v3:

Severity: Unknown
Score:
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

CWEs:

CWE-331

Affected Software
References

Software	From	Fixed in
typo3 / cms-core	12.0.0	12.4.37
typo3 / cms-core	13.0.0	13.4.18

https://github.com/TYPO3-CMS/core/commit/d2057cc7b2c2db417a2af38c30cb9da42302ab70
https://typo3.org/security/advisory/typo3-core-sa-2025-019

Deep Security Visibility Without the Complexity

SynScan provides clear, real-time security insights so you can monitor your attack surface, spot risks early, and act fast—without extra complexity.

No setup fees
5-min deployment
Cancel anytime

Book a Demo